GWS Manager — The Google Workspace Settings Hub

The dashboard IT administrators use to manage Gmail delegation, Send As aliases, forwarding rules, filters, signatures, vacation auto-responders and Calendar sharing across every user in their Google Workspace domain — with Slack and Google Chat webhook notifications.

Google Workspace’s Admin Console is powerful, but managing individual Gmail settings across many users is tedious. GWS Manager gives you a single dashboard for the per-user work — and now it runs on your own server, with the bulk engine built to survive a real domain.

Manual vs. GWS Manager

Without	With GWS Manager
Log into each user’s account, or use complex API scripts.	One dashboard for every Gmail setting across the domain.
No central view of delegation, forwarding or filters.	See who has access to what, and every user’s current settings.
Signatures, filters and vacation responders have no Admin Console screen — they exist only in the API.	Delegation, Send As, forwarding, filters, vacation, signatures, Calendar ACLs — from one place.
Typical effort: hours per batch	Typical effort: minutes

One thing worth being precise about: the Admin Console has no per-user signature setting. Its own answer for signatures at scale is Append footer (text appended to outbound mail), a note that you can use the Gmail API to apply the same signature to everyone’s settings, and a pointer to the Workspace Marketplace. Per-user signatures, delegates, filters and vacation responders live in the Gmail API — which is what this dashboard drives.

What it does

Gmail delegation	Add or remove delegates for any user’s mailbox, and see who has access at a glance across the domain.
Send As	Send emails from aliases and group addresses.
Forwarding	Configure forwarding addresses and auto-forwarding rules for users, without needing access to their accounts.
Filters	Create and manage Gmail filters centrally — and audit them for delivery issues. Spot filters that silently skip the inbox or auto-delete mail, and fix them in one click.
Vacation responders	Out-of-office auto-replies with start and end dates, and custom messages. Set them per user, or for everyone at once.
Signatures	Manage email signatures with templates — a visual editor with placeholders, so each person gets their own: {{name}}, {{title}}, {{department}}, {{company}}, {{phone}}, {{photoUrl}} and more.
Calendar sharing	Calendar ACL rules — share calendars with individuals, groups or your whole domain.
Users	Browse every user in your directory with their current settings. Refresh from Google, and export.
Webhook notifications	Every admin action fires a webhook to your Slack or Google Chat channel — with the action, the actor and the details.
Bulk signatures	Apply a signature template to a whole audience as a background job, with per-user progress and retry.
Scheduled applies	Set signatures to re-apply on a schedule: daily, chosen weekdays, monthly, or every N minutes.
Job history	Every bulk run and scheduled run, with progress, failures and the reason for each failure.

Target what you mean

Selecting five thousand people from a checkbox list is not a workflow. You can build an audience from:

• Organisational units, with an include-sub-OUs toggle
• Google Groups — direct members only; nested membership is deliberately not expanded, and the UI says so
• A text filter across names and addresses
• Manual picks, plus explicit exclusions

The recipient count updates live, and you get a preview before you commit.

Runs on your server

The dashboard is the same; the hosting model is the difference.

• Your data stays yours — one container, a SQLite database on your own volume. No account with us, no telemetry, no per-user tiers.
• No user limits. No 10, 25, 100 or 300 seat caps — run it against 50 accounts or 50,000.
• No password ever leaves Google. It uses a service account with domain-wide delegation, and the private key is encrypted at rest with a key you generate and hold.
• The stored key is encrypted with a credential only you hold (ENCRYPTION_KEY). Lose it and the key can’t be read back — that is the point.
• Docker image, or a compose file with bundled HTTPS. Nothing phones home.

Free for internal use

GWS Manager is free to run for your own organisation, at any size — business, nonprofit, school, government, home lab. No registration, no licence fee, no user limits.

You may not redistribute it or offer it to others as a hosted service. Commercial licensing is available for that — get in touch.

Source, documentation and the container image are public, so you can audit exactly what it does before you point it at your domain.

Popular use cases

Employee onboarding delegation · Send As alias setup · shared mailbox access · company-wide vacation responders · email forwarding setup · compliance and audit · filter management · Calendar sharing · Slack and Chat notifications.

Frequently asked questions

What is GWS Manager?

A dashboard for the Gmail and Calendar settings that exist per user rather than per domain — delegation, Send As aliases, forwarding, filters, signatures, vacation responders and Calendar sharing. You connect it to your Workspace domain with a service account, and manage any user’s settings from one screen instead of logging into each account.

How does domain-wide delegation work here?

You create a Google Cloud project, a service account, and authorise it in the Admin Console for the scopes you want. The app signs a short-lived JWT for the user it’s acting on and calls the Gmail or Calendar API as that user. No user password is involved at any point. There’s a script that provisions the project, and a setup tutorial.

What can I manage with it?

Delegation, Send As aliases and groups, forwarding addresses and rules, filters, vacation responders, signatures, Calendar ACLs, and your user directory — plus bulk signature applies, scheduled applies and webhook notifications.

Do I need to be a Google Workspace super admin?

To authorise domain-wide delegation, yes — that’s a Google requirement, not ours. Day-to-day, the app only needs the service account to be authorised for the scopes you choose.

How are admin actions tracked?

Every action fires a webhook to a Slack or Google Chat channel with the action, the actor and the details. Bulk runs also keep their own history: progress, per-user failures and the reason for each one.

Is my data secure?

The service-account key is encrypted at rest with an ENCRYPTION_KEY you generate and hold, and the app talks only to Google’s APIs. Everything else — the user cache, templates, job history — lives in a SQLite file on your own volume. Nothing is sent to us.

Do I need to know anything about servers?

You need somewhere to run a container. The image is self-contained — PocketBase and the signer are inside it — so docker run is enough, and there’s a compose file with HTTPS if you want it. If you’d rather not deal with it at all, we deploy and maintain it for you.

What if I lose the encryption key?

The service-account key stored in the database can’t be read back, and every Google call fails. You’d re-upload the Google key. Back it up somewhere real — the README is emphatic about this, because a wrong key does not error, it just fails silently.